reverse-engineering skills

297 tagged reverse-engineering, measured the same way as everything else here.

Browse within: malware-analysis 76dfir 65penetration-testing 62bugbounty 61web-security 61fuzzing 60mitre-attack 60reconnaissance 60detection-engineering 58ghidra 32android 28APK 25static-analysis 23specifications 22

JS Reverse Analyzer

49

sjhhh024-cmyk/Spider-JS-Mcp-Skills

Skill Claude CodeCodex

A general-purpose guide for examining JavaScript code to identify website encryption, request signatures, and anti-bot checks, then documenting the findings in Python.

10 7mo ago A 37 tokens original Apache-2.0

shangdi-w/-skills

Skill Claude CodeCodex

A toolkit for taking software apart to inspect how it works, across formats such as Android packages, Windows programs, Linux binaries, JavaScript, and firmware.

10 3mo ago A 97 tokens

redteam-av-evasion

51

shangdi-w/-skills

Skill Claude CodeCodex

A red-team security skill about avoiding antivirus detection, from basic principles to intermediate techniques. Red teams are authorised security testers who simulate attacks to find weaknesses.

10 3mo ago A 83 tokens

iron-system

52

william1mufassa/IRON-SYSTEM

Skill Claude CodeCodex

Meta-skill for reverse loop engineering that transforms an AI agent's approach to any complex task. Combines systematic deconstruction (reverse engineering) and iterative construction (loop engineering) in an EXTRACT→SYNTHESIZE→BUILD→AUDIT cycle. Includes 7 named tactical loops (FORGE, SIEGE, PRISM, RAZOR, MIRROR…

9 2mo ago A 235 tokens original MIT

benchmark

53

voidmatcha/ui-clone-skills

Skill Claude CodeCodex

Part of ui-clone-skills

Local-only regression / benchmark skill for ui-clone-skills maintainers. Drives the standard ui-reverse-engineering pipeline against the canonical reference site (https://realfood.gov) and records AE/SSIM, iteration count, gate fail counts, and outcome to benchmark/history.csv so prompt / sub-doc / model-version drift…

8 3d ago A 152 tokens original Apache-2.0

ui-capture

54

voidmatcha/ui-clone-skills

Skill Claude CodeCodex

Part of ui-clone-skills

Capture website visuals and behavior: screenshots, scroll, hover, mouse, parallax, timers, and comparison evidence.

8 3d ago A 27 tokens original Apache-2.0

visual-debug

55

voidmatcha/ui-clone-skills

Skill Claude CodeCodex

Part of ui-clone-skills

Compare reference vs implementation with AE/SSIM/pixel diff; find visual mismatches when UI looks off or doesn't match.

8 3d ago A 28 tokens original Apache-2.0

website-to-cli

56

dennisonbertram/website-to-cli

Skill Claude CodeCodex

Turn any website into a fast, beautiful command-line client. Use when the user wants a CLI that replicates a site's features by capturing its network traffic (HAR), recovering the private/undocumented API behind it, and generating a typed terminal client that calls those endpoints directly instead of driving a browser…

5 1mo ago A 111 tokens original MIT

claude-code-prompt

57

xiufengsun/claude-code-prompt

Skill Claude CodeCodex

Reference Claude Code's prompt engineering patterns for AI/Agent development. Provides best practices for system prompts, tool design, agent orchestration, and safety.

5 5mo ago A 36 tokens original MIT

ai-product-teardown

58

w93139/ai-product-teardown

Skill Claude CodeCodex

Reverse-engineer an AI product from authenticated UI evidence, including autonomous screenshot collection when safe browser or desktop controls are available, producing traceable user journeys, Agent I/O contracts, functional-equivalent prompts, or layered product architecture. Use for read-only product teardowns…

5 8d ago A 88 tokens original MIT

ghidra-agent-cli

59

ByteLandTechnology/headless-ghidra

Skill Claude CodeCodex

Rust CLI reference for the headless-ghidra pipeline. Covers command syntax, flags, output contract, artifact paths, and workspace layout for all ghidra-agent-cli subcommands. Load when: constructing a ghidra-agent-cli command, interpreting its output, resolving a flag or artifact path question, or debugging CLI…

5 4mo ago A 95 tokens

ByteLandTechnology/headless-ghidra

Skill Claude CodeCodex

Thoroughly analyze a single function by first recovering its type definitions, constant definitions, vtables, function name and signature, then producing the final decompilation. Use when the user wants a complete per-function analysis following the strict recovery order: types → constants → vtables → function…

5 4mo ago A 72 tokens

headless-ghidra

61

ByteLandTechnology/headless-ghidra

Skill Claude CodeCodex

Entry skill for the Headless Ghidra YAML-first reverse-engineering pipeline. Use when the user asks to analyze, decompile, triage, resume, or iterate on a binary target with Ghidra/headless-ghidra. Reads artifacts/ /pipeline-state.yaml, routes P0–P4 phase skills, runs gate checks, and manages review pauses. Performs…

5 4mo ago A 87 tokens

auto-re

63

timwhitez/AutoRE-CLI

Skill Claude CodeCodex

Use Auto-RE CLI for bounded, machine-readable static reverse engineering of ELF, PE/COFF, Mach-O, universal Mach-O, object files, and explicitly identified raw shellcode. Use for binary or malware triage, decompilation, function/CFG/IL inspection, static call and data relationships, PE resources or strings, Go/Rust…

4 17d ago A 104 tokens original MIT

broadside

64

HuginnIndustries/CodeCartographer

Skill Claude CodeCodex

Interpret a Broad-Side batch reconnaissance run. Use after codecartobroadside collect has produced .codecarto/broadside/ / results, to triage scouting signals before or during an interactive CodeCartographer pipeline run.

4 3d ago A 52 tokens original MIT

apply-spec-deltas

65

HuginnIndustries/CodeCartographer

Skill Claude CodeCodex

Apply triaged spec deltas (from spike findings, defect-scan corrections, post-implementation discoveries, or any source proposing changes to a finished reimplementation spec) without rubber-stamping. Use this skill after the pipeline has produced a complete reimplementation-spec and a separate source has surfaced…

4 3d ago A 121 tokens original MIT

codecartographer

66

HuginnIndustries/CodeCartographer

Skill Claude CodeCodex

Drive the CodeCartographer MCP server to reverse-engineer a repository or synthesize a new project through validated analysis phases. Use when asked to run CodeCartographer, analyze or reverse-engineer a codebase, produce architecture/contracts/protocols/defect/porting/reimplementation artifacts, or operate a…

4 3d ago A 72 tokens original MIT

lukejenkins/claude-openocd-spi-dump

Skill Claude CodeCodex

Part of openocd-spi-dump

This skill should be used when the user asks to "dump SPI flash", "read EEPROM through OpenOCD", "dump flash via MCU", "read SPI through debug interface", "extract firmware from SPI", or mentions scenarios involving SPI flash connected to a microcontroller with SWD/JTAG debug access. Provides comprehensive guidance…

3 8mo ago A 84 tokens

il2cpp-decompiler

68

rkuhn153/il2cpp-decompiler

Skill Claude CodeCodex

Static analysis for Unity IL2CPP games via il2cpp-decompiler-agent MCP (listdumps, loadproject, searchsymbols, getclassinfo, decompilemethod). Use when runtime is IL2CPP, GameAssembly.dll is involved, or remakes like Who's Your Daddy Remake. Always MCP-first — do not start with Il2CppStudio CLI.

3 23d ago A 80 tokens original MIT

xtofuub/frida-mcp-server

Skill Claude CodeCodex

Reverse engineers iOS applications using Frida dynamic instrumentation to understand internal logic, extract encryption keys, bypass security controls, and discover hidden functionality without source code access. Use when performing authorized iOS penetration testing, analyzing proprietary protocols, understanding…

3 +1 2mo ago B 97 tokens original MIT

analyze-cc-feature

70

Prajwalsrinvas/claude-code-reverse-engineering

Skill Claude CodeCodex

Reverse engineer and analyze a specific feature in Claude Code's source. Use when the user wants to understand how a Claude Code feature works internally, or when asked to analyze Claude Code internals.

2 2mo ago A 44 tokens original MIT

legacy-discovery

72

sarveshtalele/mcp-skills-registry

Skill Claude CodeCodex

Reverse-engineer / discover a codebase. Works in two modes — provide EXACTLY one input: repourl (a github.com URL) clones the repo server-side and runs full static analysis, producing a System Design Document, architecture + dependency overview, and a 100-point quality score; repopath (a local directory the server can…

2 1mo ago A 144 tokens original MIT

At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: